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Abstract 

We study the exponential time complexity of approximate counting 
satisfying assignments of CNFs. We reduce the problem to deciding sat- 
isfiability of a CNF. Our reduction preserves the number of variables of 
the input formula and thus also preserves the exponential complexity of 
approximate counting. 

Our algorithm is also similar to an algorithm which works particular 
well in practice for which however no approximation guarantee was known. 
Towards an analysis of our reduction we provide a new inequality similar 
to the Bonami-Beckner hypercontractive inequality. 



1 Introduction 

We analyze the approximation ratio of an algorithm for approximately counting 
solutions of a CNF. The idea of our algorithm goes back to Stockmeyer. Stock- 
meyer [TH] shows that approximately counting witnesses of any NP-relation 
is possible in randomized polynomial time given access to a X^P-oracle. It 
is known that we only need an NP-oracle if we apply the Left-Over Hashing 
Lemma of Impagliazzo, Levin, and Luby |12) which we discuss below. The use 
of an NP-oracle is necessary, unless P = NP. Stockmeyer's result and its im- 
provement provides us with a first relation between deciding satisfiability and 
approximately counting solutions, a seemingly harder problem. 



1.1 Exponential Time Complexity 

The motivation of our results comes from exponential time complexity. Im- 
pagliazzio, Paturi, and Zane [13] develop a structural approach to classify NP- 
complete problems according to their exact time complexity. They formulate 
and prove the Sparsification Lemma for fc-CNFs. This lemma allows us to use al- 
most all known polynomial time reductions from the theory of NP-completeness 

"This work was partially done during the authors doctoral studies at ETH Zurich [20] and 
supported by the Swiss National Science Foundation SNF under project 200021-118001/1. 
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to obtain exponential hardness results. There are however problems for which 
the sparsification lemma and standard NP-reductions do not yield meaningfull 
results. Relating the exact complexity of approximately counting CNF solutions 
and the complexity of SAT is such a problem. We show: 

Let c > and assume there is an algorithm for SAT with running time 
0(2 cn ). For any S > 0, there is an algorithm which outputs with high probability 
in time 0{2 lyCJr ^ n ) the approximation s for the number of solutions s of an input 
CNF such that 

(l-2- an )s<~s<{l + 2- an )s 

with a — fit , a ,h l- 

It is not clear if this approximation problem is in 

B ppNP because of the 

super-polynomially small approximation error. An improvement of the approx- 
imation error would yield a similar reduction from #SAT to SAT. 

A further application of our algorithm is to sample a solution approximately 
uniformly from the set of all solutions [14] . The approximation error is again 
subexponentially small in n. The reduction in |14j preserves the number of 
variables. 

We can get also a result similar to Stockmeyer's result. For any problem 
in parameterized SNP [13] - an appropriate refinement and subset of NP - we 
can define its counting version. Every such problem reduces by our result and 
the sparsification lemma to SAT at the expense of an increase of n to 0{ri) 
variables. Here, n may be the number of vertices in the graph coloring problem 
or a similar parameter [13]. We just have to observe that the sparsification 
lemma preserves the number of solutions. 

1.2 A Practical Algorithm 

Stockmeyer's idea was implemented in |llj . Gomes et al. |11] provide an im- 
plementation of a reduction which uses a SAT-solver to answer oracle queries. 
The algorithm of Gomes et al. [11] is almost the same as our algorithm. It pre- 
serves the number of variables and the maximum clause width is small. These 
properties seem to be crucial for a fast implementation, in particular, for the 
SAT-solver to work fast. 

Gomes et al. |llj compare empirically the running time of their algorithm to 
the running time of exact counting algorithms. Their algorithm performs well on 
the tested hard instances and actually outperforms exact counting algorithms. 
The output values seem to be good approximations. The reason for this is not 
understood by theoretical means yet. A bound on the approximation ratio is 
not known. 

Because there are only small differences between our algorithm and the al- 
gorithm of Gomes et al. [11] , our bound on the approximation guarantee may 
be considered as a theoretical justification for the quality of the algorithm of 
Gomes et al. [11]. We do not attempt here to explain why the SAT-solver is 
able to handle the generated instances well. 



2 



Another algorithm for the fc-CNF case with theoretical bounds was proposed 
by Thurely [TS]. 

1.3 Comparison to the Left-Over Hashing Lemma 

A possible reduction from approximate counting to satisfiability testing works 
roughly as follows. We assume to have a procedure which takes as input a CNF 
F with n variables and a parameter m. It outputs a CNF F A G m such that 
the number of solutions of F A G m times 2 m is approximately the number of 
solutions of F. We apply this procedure for m = 1, ...,n and stop as soon as 
F A G m is unsatisfiable. Using the information when the algorithm stops we 
can get a good approximation. 

The construction of G m reduces to the following randomness extraction 
problem. We have given a random point x € {0, 1}™ and want a function 
h : {0, 1}" — > {0, l} m such that h{x) is almost uniform. We think of h as m 
functions (h±, h m ) and additionally require that each hi depends only on few 
coordinates. We use the later property to efficiently encode h as a CNF in 
such a way that the encoding and the input CNF F have the same number of 
variables. Stockmeyer's result and its improvement can not be adapted easily 
to get such an efficient encoding. The crucial difference of our approach to 
the original approach are the bounds on the locality of the hash function. Our 
analysis is Fourier-analytic whereas the proof of Left-Over Hashing Lemma [12] 
uses probabilistic techniques. 

Impagliazzo et al. |12j show that any pairwise independent family T-L ln d 
of functions of the form {0, 1}™ — > {0, l} m satisfies the following extraction 
property: Fix a distribution / over the cube {0, 1}" with bounded min-entropjH 
fi(m + log(l/e)) and y G {0,1}'"- Then, 

Pr (| Pr (M*) = V) ~ 2" m | < s2- m ) > 0.1. 

This result, in a slightly more general form [12], is called the Left-Over Hashing 
Lemma. We want for our applications that h, seen as a random function, has 
besides the extraction property a couple of additional properties. The most im- 
portant being that hi is a Boolean function depending on at most k coordinates. 
This is what we call a local hash function. These hash functions are however 
not necessarily pairwise independent. This leads to a substantial problem. The 
proof of the Left-Over Hashing Lemma relies on pairwise independence since it 
allows an application of Chebyshev's Inequality. In its proof we define the ran- 
dom variable X — X(h) :— Pr xr ^f(h(x) = y). Its expected value is 2~ m . This 
still holds in our situation. Its variance can be however too large for an applica- 
tion of Chebyshev's Inequality. To circumvent the use of Chebyshev's Inequality 
we formulate the problem in terms of Fourier analysis of Boolean functions. We 

1 Pairwise independence means here that Pr/^-^ d (h(x\) = yi,h(x'z) = J/2) = 2~ 2m for 
any x\ , X2 £ {0, l} n , x\ ^ X2, and y\,y-2 £ {0, l} m . A Bernoulli matrix with bias ^ induces 
a for example a pairwise independent family. 

2 See Sec. [2] 
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make use of a close connection between linear hash functions attaining the ex- 
traction property and the Fourier spectrum of probability distributions over the 
cube {0,1}". 

1.4 Further related work 

Calabro et al. [5] give a probabilistic construction of a "local hash function" 
without the extraction property. They obtain a similar reduction as the Valiant- 
Vazirani reduction [23]. The extraction property is not necessary for this pur- 
pose. Gavinsky et al. [9] obtain a local hash function via the Bonami-Beckner 
Hypercontractive Inequality. However only for \A\ > 2"~°(^ / "). We remark 
that the motivations and applications in 9] are different from ours. 

We lend the term extraction property from Goldreich & Wigderson [10] . The 
goal in 10 is to find small families of hash functions to reduce the amount of 
random bits needed to sample the hash function. In a more restrictive setting 
motivated by problems in cryptography also locality plays an important role. 
Vadhan [21] studies locally computable extractors. A locally computable ex- 
tractor is essentially the same as a local hash function but with the difference 
that the functions hx,...,h m which constitute the hash function may depend 
in total on 0(m) coordinates. A notion of locality (for pseudorandom genera- 
tors) which is closer to ours is studied in the context of cryptography [1] and 
inapproximability [2]. 

The Bonami-Beckner Hypercontractive Inequality, credited to Bonami [4 
and Beckner [3], found several diverse applications. See [17] for further refer- 
ences. 

2 Preliminaries 

We make the following conventions. We assume uniform sampling if we sample 
from a set without specifying the distribution. We also use a special O(-) nota- 
tion for estimating the running time of algorithms. We suppress a polynomial 
factor depending on the input size by writing O(-). As an example, SAT can be 
solved in time 0(2"). We denote the logarithm with base 2 by log(-) and the 
logarithm naturalis by ln(-). 

A n-junta is a Boolean function which depends on at most k out of n co- 
ordinates. We extend this notion to functions h : {0,1}" — > {0,1}™, h = 
(hi, h m ), by requiring that hi is a K-junta for every i 6 [m]. A Boolean 
function / : {0, 1}" — > R is a distribution iff all values of / are non-negative and 
sum up to 1. It has min-entropy £ iff t is the largest r with f(x) < 2~ r for all 
x € {0, 1}". The relative min-entropy t is defined as t := t/n. A distribution / 
is t-flat iff f(x) = 2"* or f(x) = for all x G {0, 1}". 

Definition 1. Let < pi,P2 < 1- Let T> be a. distribution over functions of the 
form {0, 1}" — > {0, l} m . A random function h is called n-local with probability 
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Pi iff 

Pr (h is K-local) > p\. 

It is called a (to, e)-hash function (for flat distributions) with probability pi iff 
Pr (| Pr (h(x) =y)- T m \ < s2- m ) > p 2 

for every y £ {0, l} m and every (fiat) distribution / of min-entropy t with 
to < t < n. 

3 Local Hash functions: Construction and Anal- 
ysis 

We start with the definition/construction of the two hash functions h and h c . 
After this we discuss a basic connection between Fourier coefficients of distribu- 
tions and the special case of linear hash functions with a one-dimensional range. 
We generalize this finally to functions with the high-dimensional range {0, l} m . 

Construction of h: For i = 1, ...,m: Choose a set Si <~ /U p . Define hj(x) := 
®jeSi x i- T ne nasn function is h := (hi, h m ). 

In other words, h is the linear map given by a Bernoulli matrix with bias p. 

Construction of h c : Fix k. For i = l,...,m: Choose a set Si <~ {S : S C 

[n], \S\ = k}. Define h?(or) := 0j e s 4 Xj. The hash function is h c := (hf , h^). 

3.1 Hashing, Randomness Extraction, and the discrete 
Fourier transform 

We start with recalling basics from Fourier analysis of Boolean functions. The 
Fourier transform of Boolean functions is a functional which maps / : {0, 1}" — > 
M to /: 2N — > R and which we define by f(S) := E x ^ {0 ,i } n(/(a;) (-l)©ies x< ), 
SC. {n}. We will study the following normalized Fourier transform given by 
f(S) := 2" _1 /(S*). We call the values of / Fourier coefficients and the collection 
of Fourier coefficients the Fourier spectrum of /. 

We can rewrite normalized Fourier coefficients to see the connection to hash- 
ing and randomness extraction. We define ie {j x, := 0. 

Lemma 1. Let / : {0, 1}" — > R be a distribution. For any S C [n], 
f(S) = Pr (0x, = 0) - 1 = \ - Pr (0x, = 1). 
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We may think of (B ie ,g x< as a single bit which we extract from /. We 
are interested in how close to a uniformly distributed bit it is. There is also 
a combinatorial interpretation of randomness extraction which we are going to 
use subsequently. We define for non-empty A C {0, 1}" the flat distribution 
Ja{x) := jjn if a; G A and otherwise. We want a random hash function 
h : {0, 1}™ -> {0, 1} such that for every not too small A C {0, 1}" and b e {0, 1}, 
Pih {\P y x~f A (h(x) = b) — | is small) is large. This is the same as saying that 
the probability of the event \A H {x € A : h(x) = b}\ « ^ should be large. In 
words, the hyperplane in induced by /i separates A in roughly equal sized 
parts. 



3.2 Analysis of Local Hash Function 

In this section we describe our technical tools for analyzing linear local hash 
functions. We show how to apply them on the example of the two functions h 
and h c . The first result we need is an inequality similar to the hypercontractive 
inequality for Boolean functions. We prove actually a more general inequality. 
It allows us to analyze linear and local hash functions with a one-dimensional 
range. For the generalization to functions with a high-dimensional range we use 
a different technique. 



3.2.1 An Inequality 

We give an outline of the proof. The support of a function g : {0, 1}™ — > R is 
the set of all points with a non-zero value and denoted by Supp(g). The norms 
below are w.r.t. the counting measure. Define 

||(1- 2px,l-2p(l-x))\\± : 

A(a,p) := sup 



o<x<i ||(x, l-a;)|| x 

1-ap 

Lemma 2. Let f,g : {0,1}" -> {-1,0,1}, < p < |, and < a < 1. Let 
A(a,p) be such that ma,x(A(a,p), (1 - p) A ap ) < A(a,p). Then, 

E s ^ p (f(S)g(S)) < 4- n A(a,p)"(|Supp(/)| • ISupp^)!) 1 -^. 

The previous lemma is shown by induction over n. In its proof we work 
explicitly with the Bernoulli distribution S is chosen from and avoid entirely 
the use of the (noise) operator as in [3]. The purpose is to decompose in the 
induction step the n-dimensional functions / and g into (n — l)-dimensional 
functions with the same range {—1,0,1}. Preserving the range seems to be an 
interesting benefit of our new proof. 

The following estimation is the reason why it makes sense to introduce the 
new quantity a which does not occur in [3]. Setting for example a = l/log(n) 
will make A(a,p) already reasonable small. 

Lemma 3. It holds that A(a,p) < (l + 2- 1 /" +8 ) Qp for < a < |, < p < ±. 
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Finally, we arrive at the result we need. Its an application of the previous 
results together with a result of Chor & Goldreich [6] . It seems that the Bonami- 
Beckner Inequality is too weak for proving it. 

Lemma 4. Let / : {0, 1}" — » R be a distribution of relative min-entropy t, 
2 in <= {1, 2"}, and < p < \. Then, 

Es~^(|/(S)|) < \^ 
Applying the Bonami-Beckner hypercontractive inequality we get 

Lemma 5. Let / : {0, 1}™ — > R be a distribution of min-entropy t with 2* £ 
{!,..., 2"}, k be a positive integer, and < ( < 1. Then, 



E 5. 



,(W) (\7(S)\) < I n -(l-C)fc/2 2 (n-t)fc n -^ 



3.2.2 High-Dimensional Range 

Our technique for analyzing hash functions of the form {0, 1}™ — > {0, l} m works 
as follows. Assume / has min-entropy t. Conditioning on an event E C {0, 1}" 
yields a new distribution /' with min-entropy t' . We can not say much about the 
relation of t and tf in general. If E is however a hyperplane (in the vector space 
F™ ) induced by © ie s Xi then our inequality from above tells us that t' ps /j — 1 in 
the expectation, 5 ~ /i p . Iterating this step and keeping control of the entropy 
decay we get our result. This process works as long as we reach some threshold 
to which is essentially determined by the bias p. 

Formally, the proof is an induction over m and the induction step an ap- 
plication of Lemma El We apply it to distributions /, which we define in- 
ductively for concrete h* : {0, 1}" -> {0, 1}'™. For i = 0, f := /. For 
i > 0, fi is fa-i conditioned on the event {x € {0,1}™ : h*(x) — j/j}, i.e., 
fi(z) :— Pv xr ^f i _ 1 (x = z I h*{x) = yi). The function fi is not well defined for 
every h* since Pr x ^_j (h*(x) =y%) =0 is possible. If this is the case we define 
fj to be on all points and for all j > i. The following condition excludes this 
case if 77 < 1. 

Vl<i<m:| Pr (h*(x) = Vl ) - 1/2| < T)/2 (1) 

The next lemma allows us to bound the error of approximation, in particular, 
how far Pr x ^j (h* (x) = y) is from the optimal value 2~ m . 

Lemma 6. Let < 77 < 1. If Cond. [T]holds for h* , then 

1. (1 - r,Y 2~i < Pv^fihKx) = y u h*(x) = y s ) < (1 + rtf 2^', j = 1, m, 

2. I Pr x ^ f (h*(x) =y)- 2-™| < 2~ m ((1 + V ) m - 1). 

In the proof of our main lemma we establish the desired extraction property 
for h and h c . 
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Lemma 7 (Main Lemma). Let 0<E<l,0<p<4. Define 

PU) — ^^^p™*/ 108 * 512 /*) 
e 

Hash Function h. If there exists to such that P — P(to) < 1 and ton + m + 1 < 
n, then h is a (ton + m+l, e)-hash function for flat distributions with probability 
at least (1 - P) m > 0. 

Let 0<e<l, 0<C<1- Let k be a positive integer. Define 

Q(t) : =Ul n -a-Ok/2 2 (n-t)kn-^ 

Hash Function h c . If there exists to such that Q = Q(to) < 1 and to + m+ 1 < 
n, then h c is a (to + m+1, e)-hash function for flat distributions with probability 
at least (1 - Q) m > 0. 

We argue next that the restriction p = f2( los ^ m ) ) and that the trade-off 
between the entropy of the distribution and the bias p are essentially optimal. 
In other words, we can only expect small improvements of the Main Lemma. 

3.2.3 Rank of Bernoulli Matrices 

We recall the combinatorial idea behind hashing. Let M be a Bernoulli matrix 
with bias p and let y € {0, l} m . The preimage of M, y intersects any large 
enough subset A C {0, 1}™ in approximately \A\ ■ 2~ m points. Let us assume 
rn = n. If especially A = {0, 1}™ we expect that the linear system Mx = y has 
one solution in W%. This is is the case iff M has full rank. The threshold for this 
property is around Q( lo s( w ) ) p?], j n particular, the probability that M has full 
rank can get very small and in which case M fails to have the extraction property 
with high probability. With respect to this consideration it is not surprising that 
our probabilistic construction becomes efficient only if p — Q( lo s(") y 

3.2.4 The Isolation Problem 

We will argue next that also the trade-off between the size of A, i.e. the min- 
entropy of the corresponding flat distribution, and p is close to optimal. Actu- 
ally, we can restrict A to be the solution set of a fc-CNF. The following result 
is due to Calabro et al. [5]: For any distribution T> of /c-CNFs over n vari- 
ables, there is a satisfiable A:-CNF F such that Pr F /^p(|sol(F) nsol(F')| = 1) < 
2 -n(n/fe) ) where so i(_f) (sol(F')) refers to the set of solutions of F (F'). The 
corresponding problem of computing F 1 is the Isolation Problem for fc-CNFs [5] . 
We show how the Main Lemma relates to a solution of this problem. Let G be 
a fc-CNF and let p = k = 0(ftlog(ft) log(n)). The Main Lemma guarantees 
just that |sol(G) nsol(G")|, G' the CNF-encoding of h, is with high probability 
within a small interval around v — 2°^"/ K '. We need to define an appropriate 
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Input: CNF F over n variables and a parameter k. 

1. Setp:=M±. 

2. For Z = 1, n+ 1: 



3. Repeat 8[log(n)] times: 

4. Construct h. Select b ~ {0, 1}'. 

5. If IS'il > k for some i £ [Z] then stop. 

6. Let G be the fc-CNF encoding of h(x) = b. 

7. Record if F A G is satisfiable. 

8. If unsatisfiability was recorded more than 4[log(n)] times 

9. then output 2 !_1 and stop. 



10. Output 0. 

Figure 1: Algorithm ACOUNT with access to a SAT-oracle 

distribution T>o to apply the mentioned result. Chernoff's Inequality guaran- 
tees that h is encodable as a fc-CNF G" with high probability. We extend G" 
by constraints (literals) which encode Xi = or Xi = 1 as follows. Uniformly 
at random select a set of log(u) variables. Uniformly at random set the value 
of these variables. This defines our distribution T>q. With probability at least 
2 -o(« io g (K)/ K ) we get a Q(k)-CNF G' such that |sol(G) n sol(G")| = 1. The 
reason for this is the following simple to prove fact (Exercise 12.2, pg. 152 in 
[IB]): Let B C {0, 1}™ be non-empty. There exists a set of coordinates / C [n] 
and b € {0, 1} 1 such that |/| < log(|B|) and \{x € B : Xl = b t Vi G I}\ = 1. Note 
that the construction of T>q depends only on the parameters n, k, and m, but 
not on the input fc-CNF G. We can thus apply the result of Calabro et al. [5]. 
Comparing the lower and and upper bound we see that we are off by a factor 
(9(log(fc) 2 log(n)) in the exponent. 

4 Complexity of Approximate Counting 

The algorithm is depicted in Fig. [TJ It is similar to the algorithm of Gomes et al. 
|llj . One difference is the construction of h which is a Bernoulli matrix with bias 
p in our case. Gomes et al. |11) select uniformly at random a linear function 
which depends on exactly k coordinates for every row. Another difference is 
the output. We output an approximation for the number of solutions. The 
algorithm of Gomes et al. |11) outputs a lower and an upper bound. Besides 
the experimental results, they can show that with high probability the output 
lower bound is indeed smaller than the number of solutions. They give however 
no estimation for the quality of the output bounds which would be necessary 
for bounding the approximation ratio. 

We define algorithm ACOUNT-CONSTANT similar to ACOUNT but with the 
only difference that it constructs h c . We stress the fact that our algorithms are 
easy to implement and that we can amplify the success probability further by 
repeating the inner loop appropriately. 
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Theorem 1. 1. (Complexity of Approximate Counting) Let c > and 

assume there is an algorithm for SAT with running time 0(2 cn ). For any 5 > 0, 
there is an algorithm which outputs with high probability in time 0(2^ c+<5 '") 
the approximation s for the number of solutions s of an input CNF such that 

(l-2- an )s<§< (l + 2- an )s 

with a = Q( r -C T ). 

2. (Algorithm Analysis) Let k be such that 41og(16n) < k + 1 < n 
and let k be such that k + 1 = k log(512/«) 4 log(16n). Let s be the number 
of solutions of F. The probability that algorithm ACOUNT outputs in time 
0(n ■ log(n) • (n 2 + 2 fe • k ■ n + sizc(F))) the approximation s such that 

i 2 - n / K s<S<As 
4 ~ ~ 

is at least 1/4. 

For constant k > 5, the probability that algorithm ACOUNT-CONSTANT out- 
puts the approximation s such that 

1 i l°s(") „l-4/fc 

_2-"+^^ n s<S<4s 
4 ~ ~ 

is at least 1/4. 
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Appendix 



A Proof of Lemma [T] 

Proof. Let / be the image of / and X p := {x € {0, 1}™ : f(x) = p}, p € I. Let 
S:={i6{0 ) l} ,, :© jes n = l}. 

f(S) = 2 n - 1 K x (f(x) (-l)©iW) = 

= £ p ( Pr(/(x) = p, x, - 0) - Pr(/(tf) = p,^ Xi = l] 
pel ^ 35 igS ' tes 



2 " _1 E P ( , (/W = P) - 2 • Pr , (/(*) = P> * e £)) 

^ P (iix P i-ix P nsi) = i £ p-x; E p= 

pel ^ ' pei,xex p pel xex p nE 

|-pj f (0^ = 1 )=pj f (®^ = °)-^ 



□ 



B Proof of Lemma [2] 

Proof. The proof is by induction on n. Let n = 1. If / or 5 is the constant 
function then the claim holds. There are 8 remaining functions of the form 
{0,1} — > { — 1,0,1}. We start with functions with range {0,1}. Let hi be the 
identity function, hi be the function which maps to 1, 1 to 0, and let /13 be 
the constant 1 function. Their Fourier coefficients in order (hi({}),hi({l})) are 
(|,— 5), (5, |), and (1,0). Avoiding symmetric cases we have 6 combinations 
to check. We start our case analysis with f = g = h^: 

1 - P < 4" 1 A(a,p) 4 1 - ap = A(a,p) 4~ Qp . 

This inequality holds by definition of A(a,p). For the cases / = hi, g — h 3 and 
f = ^i, g = h 3 we have (1 — p)| on the left-hand side of the inequality: 

(1 -p) 1 < 4- 1 2 1 "^ = 1 2-°* < I(a,p) i 2" * 

since A(a,p) > 1. The cases / = g = hi and / = g = hi are immediate since 
the left-hand sides are at most j. Let hi be the function which maps to — 1 
and 1 to 1. Its Fourier coefficients are (h,4({}), /m({1})) = (0, —1). The claim is 
thus clearly true for / = g = h±. We reduce the remaining cases to the previous 
ones by using the linearity of the Fourier transform (multiplying with —1). 
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Assume that the induction hypothesis holds for n — 1. For h : {0, 1}" — > 
{—1,0,1}, let h' b (x) be 1 if h(x) — 1 and x n = 6, b 6 {0,1}, and otherwise. 
Let /if, be the restriction of h' b to first n — 1 coordinates. Let T C [n — 1]. It 
holds that 

h' b (T) =(-l) b h' b (TU{n}) (2) 
fc(T) 0) 

In what follows, S 1 is chosen from [n] according to ^ p and S" is chosen from 
[n — 1] also according to /i p . 

E s (f(S)g(S)) = 

pE s (f(S U {n}) U {n}) \neS) + (l-p) E s (f(S) g(S) \njLS). 

By the linearity of the Fourier transform (in particular, ho + hi = ho + hi) and 
by Eq. [2]and|3l 

Es(fg) = \ (Es'(Mo) + Es'(fm) + (1 - 2p)(E< ? ,(/o<?i) + E s .(fi9o)))- 

Define^ := |Supp(/&)|, y b := \Supp(g b )\, c := 1 - ap, di := 1 - 2p, and 
d 2 '■= A{a,p). By the induction hypothesis, 

Es(fg) < ((xoyoT + (x 1 yi) c + d 1 ((x yi) c + (x iyo ) c )). 

We are left with showing that 

(xoyoT + (xiyi) c + di {{x yi) c + (xiy a ) c ) < d 2 ((x a + Xi)(yo + yi)) c '■ 

This inequality becomes trivial if at least 2 variables are since di < 1 < d%. 
We assume w.l.o.g. that xo,x 1: y > 0, define r := ^i, s := and divide the 
inequality by xoyo- This yields 

1 + di (s c + r c ) + {rs) c <d 2 (l+ r) c (1 + sf . 

We define z(r, s, c) := d 2 (1 + r) c (1 + s)° — 1 — (rs) c — di (s c + r c ). We are going 
to show that there exist one tq > such that §f(fo) = first and -^{ra) > 
for all s > subsequently. This proves that r$ is a minimum. Finally, we show 
that z(tq, s,p) > 0. Differentiating z in r and dividing by cr c_1 yields 

d 2 (r- 1 + ly- 1 (1 + s) c - s c -di = 0. 

Resolving for r we get 
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Define t := d 2 d (i+s) c • Since s > and p < | we conclude that t > 0. We also 
need to show that i < 1 to conclude that ro is a positive real. By definition of 
d 2 

(|1 - 2px|^ + |l - 2p(l - x)]^) 1 c < d 2 (\x\i + |1 - x|^) c . 
We get this inequality also by multiplying 

((1 + di s c )t^ + (dx + s c )^y- c <d 2 (l + s) c (4) 

with (1 + s c ) _1 . Then, < x — < 1. Note that (fe depends only on a and 
p and not on ir. Since d ^^ e > we conclude that t < 1. 

Next, dividing ^ by c (c — l)r c_1 and noting that c(c — 1) < it holds 
that J^(ro) >0iff 

d 2 (1 + ro" 1 )" 2 ^ (1 + s) c - di - s c < 

iff 

(1 + r^)- 2+c = t^r <t. 

This inequality holds since ^^f > 1 by definition and < i < 1 as observed 
above. We are left with showing that z(ro, s,p) > 0. It holds that z(ro, s,p) > 
iff 

(tV(c-l) _ jjc + dl fl c) + s c + dj < ^ ^ + g y t c/(c-l)_ 

Dividing by d 2 (1 + s) c yields 

(t l/( C -D _ 1)C ±+Ail < t c/(c-D ^! + * = t ( ,V(c-l) _ 1} 

d 2 (l + s) c d 2 (l + s) 

iff 

di + s c 



( t i/(c-i) _ x y-i < 



1 + rfi s c 

Dividing by d\ + s c and rewriting we get Eq. 01 □ 

C Proof of Lemma [3] 

Lemma 8. 1. Let r € R and q > 1. The function r] r ^ q (x) = ||(1 — ra;, 1 — r(l — 
is convex in R and symmetric around ^, i.e., r) r q {^ — y) = ry r , g (^ + y). 

2. > 1 for every < a < 1 and < p < ~. 
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Proof. We begin with the first claim. Let < t < 1 and x,y G R. By 
Minkoswki's inequality 

tr]{x) + {l-t)7](y) = 

\\t(l- rx, 1 - r(l - x))|| g + ||(1 - i) (1 - ry, 1 - r(l - y))||, > 

||t (1 - rx, 1 - r(l - x)) + (1 - t) (1 - ry, 1 - r(l - y))||, = 

||(1 - r(ix + (1 - t) y), 1 - r(i (1 - x) + (1 - t) (1 - y))|| g = 

||(1 - r(tx + (1 - t) y), 1 - r(l - (is + (1 - t) y))\\ q = r?(tx + (1 - t) y). 

For the second claim, we have to find xq such that 

||(l-2pxo,l-2p(l-x ))||_L_ > \\(x ,l- x )\\ ^ . 

Set x = 0. It holds that ||(1, 1 - 2p)\\j_ > 1 = ||(0,1)|| 1 . □ 

The following proposition is known as Bernoulli's inequality except for the 
inequality 1 + ^ < (1 + x) r . It can be seen by showing that (1 + x) r — 1 — ^ 
is monotone increasing in [0,1]. 

Proposition 1. 1. If r > 1 and x > — 1 then (1 + x) r > 1 + rx. 

2. If < x, r < 1 then 1 + 2f < (1 + x) r < 1 + rx. 

We will also use the standard estimate (1 — < ~ < (1 — ^y) 31 , x > 1, 
without explicitly mentioning it. 

Proof. Let J(x) := ||(1 - 2px, 1 - 2p(l - x))|| ^ and u(x) := ||(x,l-x)|| 1 . 

Both functions are symmetric around x = |, Lemma |SJ It suffices thus to show 
the claim for a; G [0, ^]. We simplify the upper bound first. The function u 
attains its minimum 2~ ap at xo = h, Lemma [H Together with Proposition [I] 

(1 + 2-^ a+8 ) ap u(x) > u{x) +u(x)a P 2~ 1 / a+7 > u{x) + ap 2- 1 / Q + 6 . 

Define q :— and uo := ap2~ 1 ' a+6 . By Proposition [T] 

u(x) + uq > x q + (1 — x) q + uq > x q + 1 — qx + uo =: v(x). 

The function v is convex and monotone decreasing in [0, \] since = qx q ~ x — 
q < and J% = g(g - 1) a; 9 " 2 > for a; G (0, §]. The idea now is to find a 
tangent £ of u' which lies above I. Since I is convex, Lemma [8j we can show the 
latter by comparing I and t at x = and x = |. The function v has slope — p 

l-ap 

at x = (1 - (1 - ap)p) "p , 

/ (l-ap) 2 \ / (l-ap) 2 \ 

We define t(x) := (v(xq) + pxo) — px. 
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Case 1(0) < t(Q): 1(0) = (1 + (1 - 2p)^) ap < 1 + apexp(-f ). On the other 
side t(0) = Xq + 1 -qx + u +px > x^ + 1 — qx + u > Xq + 1— (l+2op) x + u 

where we used that — q > — (1 + 2ap). Since 1 — ap > J , cxp(— ^~° p ^ ) < 
2~i . It suffices thus to show that 

if 

< exp — exp + 61ap2 ' . 



We used 1 — ap + 2p > 1 _ 1 ( 1 _ a ^ P ) P here. Multiplying with exp(^ — 2p) and 
rearranging yields 

1 _ e-P-% < 61 e ~ 2p e° 2~ - ap. 

Noting that ^ < e~ 2p and using the estimates e~ p ~~£ > l — p— — and 1+ — < — 
we conclude the claim from 

3 61 i i 
- < e» 2-= a. 

CaseZ(i) < Z(±) = 2 Q f(l-p) < (^) p . By Proposition!]] (l - f ) 1/p > 

^ and hence (^r) P <l — f-It suffices thus to show v(xq) + pxo > 1. With the 
the same simplifications as above we get 

1 — ap 
a (1 — (1 — ap)p) 

□ 



< exp I - , l ~ aP , \ - exp (Jl^El ) + 62 ap2-i 



D Proof of Lemma [4] 

We need the following fact due to Chor & Goldreich [BJ. 

Proposition 2 (Convexity of distributions of bounded min-entropy) . Let t be 
such that 2* € {1, 2"}. A distribution / : {0, 1}" -> R has min-entropy t iff it 
is a convex combination oft-flat distributions /i, i.e., / = Xi/i + .-. + XlIl 
for some positive Aj's with Ai + ... + Xl = 1. 

Proof. Assume / is a i-flat distribution. Define s := |{a: : f(x) ^ 0}| and 
gf := [/], i.e., / rounded up point wise. The range of gj is {0,1}. Applying 
Lemma [2] and [3] and using the fact that f(S) = |j • g)(S), S C [n], 

E S ^ p (/(5) 2 ) = (2 S )- 2 4"E s ^ p ( 5 7(5) 2 ) < (2 S )- 2 (l + 2-i+ 8 ) Q P" S 2 ( 1 - Q rf < 
< 2- 2 exp ((2-^ +8 )apn S ) s~ 2ap . 
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By Jensen's Inequality, 



Es~m„(I/(S)|) < o ex P o ( 2 ~ " + ) s 



Define a := l/log(512/t). Note that s = 2* = 2*™ and a < ±. Thus, 



pill, 



E^ p (|/(5)|)<2--(^- 1 )- 1 <^- Q 

Let / be a distribution of min-entropy i now. Using the convexity of distri- 
butions of bounded min-entropy, Proposition^ and the fact that the normalized 
Fourier transform is a linear functional 



□ 



E Proof of Lemma [5] 

Proposition 3 (Kahn et al. 16 ). Let / : {0, 1}" {-1,0, 1} and < 6 < 1. 

Then, 

E <5 |5| /(^) 2 <P,r(/W^0)T^. 
SC[n] 

Proof. Assume / is a i-flat distribution. Define p := Pr x (f(x) ^ 0). Let 
9f := r/1) i- e -i / rounded up pointwise. Applying Proposition [3] and using the 
fact that f(S) = ± -f f {S), S C [n], 

E />) 2 = (2 P r 2 E 3 7(s) 2 <(2 P r 2 <r fc ^. 

se(t»i) 56(W) 



We recall that for a point r € R d , X^=i l r il — \/" 7,2 ■ This implies 

e i/-(s)i<i(;) , "*-^»-*. 

The claim for i-flat distributions follows since p = 2~( n ~*) and since 5 is chosen 
uniformly at random from Ofy. The generalization to distributions of bounded 
min-entropy follows then from Proposition [2] and the linearity of the Fourier 
transform. We set 5 = kjn^ and use the estimation \Sk\ > (n/k) k . Finally, we 
set S = kjrfi and use the estimation > (n / k) k . □ 
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F Proof of Lemma [6] 



Proof. Define k :='Px x ^f i _ 1 {h*{x) = y i )andq l := Pr x ^f(hl{x) = yi, h* (x) = 
yi). From Cond. [TJ (1 — rf)/2 < pi < (1 + r/)/2 for 1 < i < m. In particular, 
Pi 7^ and qi ^ for 1 < i < m. Thus, 

Q] = Pj 9j-i = V] Pj-i = - = Pj ■ - ■ Pi- 
The first claim follows. Define qo :— 1. By the triangle inequality, 



\q m -2- m \<Y,h-^\-2- {m ~ l) - 



Furthermore, • |& - ^| = |pj - ±|. Thus, 

la 2~ m i < V ^ - ' < ?? V 91-1 < 

I — / 2 m ^ i ~ 2 y 2 m ~ • — 

i=i i=i 



_ v u + 7?r If— _ = „ v 

Finally, 



2 ^ 2™-* ^ 2 T 

i=l i=l 



2 -m| < 2 -m 7? J2( 1+r] y-l = 2 -m ((l + ^)« - 1), 



i=l 



where we used 77 2j=i(l + r ?) 1 — (1 + f]) m — 1- □ 



G Proof of Lemma [7] 

Proof. Let / be a flat distribution of min-entropy t with to — to n < t < n- 
We define r) := We show that h satisfies Cond. Q] with probability at least 
(1 — P) m . The induction is over i — l,...,m. For i = 1, we need to show 
that | Pr x ^,j(h 1 (a;) = g/i) — 1/2| < r\ holds with probability at least 1 — P. 
From Lemma [U |Pr w (h£(x) = yi) - 1/2] = |/0S?)| where 5 X * defines h?. 
By Markov's Inequality and Lemma ffl Prs~/i p (|/(5')| > v) < -P- Note that 
1-P > 0. 

Assume the induction hypothesis holds for i < m. We condition on the 
fact that (h*,..., h*) satisfy Cond. Q] By Lemma [6] and observing that flat 
distributions are closed under conditioning we get that fi is a flat distribution. 
We need to show that | Pr a ,^,j i (h i+1 (a;) = — 1/2| < r\ holds with probability 
at least 1 - P. Again | P Wi (h* +1 (x) = y l+1 ) - 1/2| = \MS* +1 )\ where S* +1 
defines h* +1 . We want to apply Lemma 0] again. We need to verify that the 
min-entropy of fi is not too small. Equivalently, fi(z) should not be too large 
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for any z £ {0, l} ra . By Lemma [51 
fi(z) = Pr (x = z | hi(x) = yi, K(x) = y { ) 

x~f 

= Pr (x = z,hi(x) = 3/1, hi(x) = y t ) Pr (hi(jc) = yi, h;(x) = 2/i) -1 



< 2"' 2 4 (1 - »7) _i < 2 



-t+i+2 



The min-entropy of / m is thus at least t — i — 2 > t — (m — 1) — 2 > (to + 77i + 
1) — m — 1 = to- Applying Lemma 2] finishes the proof of the claim. 

We showed that h satisfies Cond.Q]with probability at least (1 — P) m . This 
implies that Pr h (| Pr w (h*(x) = y) - 2~ m | < £2" m ) > (1 - P) m by Lemma| 
and since (1 + rj) m — 1 < e. This finishes the analysis of h. The analysis for h c 
is the same as for h but we use Lemma [5] □ 



H Proof of Theorem [T] 

Proof. Claim 2 (non-constant case). Let A be the solution set of F. As- 
sume A is non-empty and fix I. Define B :— An {x : h(x) — b}, h from the l-th 
iteration of ACOUNT. 

Case \A\2~ l ~ l > 2 n l K . Define f A (x) := i if x G 4 and otherwise. By the 
Main Lemma 

Pr ( Pr (h(i) = b) - 2-' 
b,b y x~f A 

i.e., 

\\B\-\A\-2~ l \< \A\-e-2~ 1 . (5) 
We have to calculate P to see this. Set e := \. First, 

_ k + 1 2 k log(512«) log(16n) 



< e2"M > 



2n 

Thus, 



p_ l_ 2 _1 °S( 16 ™ 2 ) K log(512«) t/log(512/t) <- J_ 

e ~~ 8n 

with i = log(|A|)/n in our setting and since k log(512re) t/ log(512/t) > 1. The 
latter holds since t > - by assumption. By the Main Lemma (to = - and 
I < n — ^ — 1 since 2 < log(|A|) — I — 1 by assumption) 

(l-P r >(l-i-) n >7/8. 

We estimate the probability that h is k- local next. Let \Vi\ denote the number 
of variables depends on. By Chernoff 's Bound 

Pr(|V5| > 2pn) = Pr(|V5| > k + 1) < (e/4f" < 

h; 16?l 
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Pr(Vi : \Vi\ < k) > ( 1 - -J- ) > 7/8. 



Thus, 

PrNi ■ \VA <k\> ( } - 

16n / 

The joint probability that Eq. [5]holds and h is fc-local is thus at least 2- 1 — 1 = | . 
The inner loop amplifies this probability to 1 — 1/n. 

Case \A\2~ l+3 < 1. Let X = X(h,b) be \B\. Let X x indicate whether h(i) = b. 
Then, E(X X ) = 2~ l and thus E(A) = |A|2 _J . By Markov's Inequality, 

Pr(X < 1) > 7/8. 

n,o 

This implies that the joint probability that B = {} and h is fc-local is at least 
|. The inner loop amplifies this probability to 1 — 1/n. 

Eq. [5] implies B ^ {} HA ^ {}. Assume the algorithm stops at I = Iq € [n]. 
It outputs 2 l °~ 1 . From the first case, we get that Iq > log(|j4|) — ^ — 1 
with probability (w.p.) at least (1 — l/n) n+1 because the algorithm contin- 
ues if Iq < log(|A|) — — — 1 w.p. at least 1 — 1/n per step. From the second 
case, < l°g(l^l) + 3 w.p. at least 1 — 1/n because the algorithm stops if 
lo > log(|A|) + 3 w.p. at least 1 — 1/n. 

We do not know how the algorithm behaves in the range 57(1) < log(|A|) < 
^ + O(l). This causes the approximation error. We can overcome this problem 
using a simply technique to prove the second claim. 

Claim 2 (constant case). This analysis remains the same as in the non- 
constant case. We are just have to show (1 — Q) m > 1/4 which follows from 
Q < i and e := \, ( := 1 - f, to := n - ^ n^K 

Claim 1. We note that we can count the number of solutions exactly in time 
0(2( c +<5)«) if |A| < 2 Sn . This follows from the self-reducibility of SAT and the 
prerequisites. Set S := ^. If p < | we know that h is with high probability 
(Jn)-local. We can encode a (5n)-local hash function in time <D(2 Sn ) as a CNF. 
We adapt ACOUNT in the following way: If the input CNF F has more than 
[2*™] solutions we construct h for I = 1, [(1 — S)n~\ and continue as long as 
F A G has at least [2 Sn \ solutions. We output the exact number of solutions 
of F A G times 2 l . The analysis goes as follows. We observe that as soon as 
\A\2~ 1 < [2 5n \ we know it and the approximation error is thus determined by 
Eq. [5] Rewriting Eq. [S] we get 

(1 - e) | A| < |.B| 2* < (1 + e) 

For some p — 0(6) and t > 5 we get from the Main Lemma 

p = 2 -0(5 2 r 1 /log(l/,5)-log(i)) 

which is small enough for some log(i) = il(5 2 n/ log(l/<5)). □ 
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